6502.org http://forum.6502.org/ |
|
Snooping on the C64 Expansion port http://forum.6502.org/viewtopic.php?f=10&t=5050 |
Page 1 of 1 |
Author: | fastgear [ Sat Jan 20, 2018 9:07 am ] |
Post subject: | Snooping on the C64 Expansion port |
I recently read that the Turbo Chameleon 64 Cartridge provides a VGA replica of the VIC-II via clever bus snooping. Thinking about it for a while it make sense that you can get all the information you need to replicate a VIC-II display by just snooping on the expansion port. There is however one thing I am curious about: Is it possible for a cardridge to tell whether the IO peripheral space (at d000- dffff) is switched in or out of cpu view? Without this knowledge a cardridge would not be able to tell whether a write to the region D000-D029 was really meant for a VIC-II register or whether it was meant for the RAM underneath. |
Author: | hmn [ Sat Jan 20, 2018 10:01 am ] |
Post subject: | Re: Snooping on the C64 Expansion port |
Are the writes to the processor port register at $0001 (which seems to do the switching) not also snoopable? Another method would be to trace what instructions were fetched, but that would obviously be much more involved. Related: The HiDef NES by Kevin Horton, aka kevtris. That is a HDMI mod for the NES, also implemented by snooping the bus. The development was chronicled in a series of videos on YouTube. |
Author: | fastgear [ Sat Jan 20, 2018 11:02 am ] |
Post subject: | Re: Snooping on the C64 Expansion port |
That is a good question! I know that read/writes to memory location 0 and 1 gets deligated to 2 registers living on the 6510 itself. But can anyone tell if the deaigners of the 6510 actually bothered to disable the adrress bus and databus on the cpu when these two memory locations is accessed? |
Author: | BigEd [ Sat Jan 20, 2018 11:54 am ] |
Post subject: | Re: Snooping on the C64 Expansion port |
I've a feeling writes to those two ports do go to RAM (and the values can be read back by some sprite collision trickery) |
Author: | Dr Jefyll [ Sat Jan 20, 2018 1:49 pm ] |
Post subject: | Re: Snooping on the C64 Expansion port |
BigEd wrote: I've a feeling writes to those two ports do go to RAM I have the same feeling. And I'll bet reads also go to RAM, but the value returned is ignored. That's alright, though. It's the writes which would interest you.
|
Author: | fastgear [ Sat Jan 20, 2018 2:28 pm ] |
Post subject: | Re: Snooping on the C64 Expansion port |
Thanks for the pointers BigEd and Dr Jefyll. I actually found this post also mentioning the sprite collission trickery: http://www.lemon64.com/forum/viewtopic. ... 2d4af65bda Looks like with snooping on the expansion pirt you can indeed detect bank switching |
Author: | fastgear [ Sun Jan 21, 2018 4:11 pm ] |
Post subject: | Re: Snooping on the C64 Expansion port |
I actually spotted some useful info in Christian Bauer's VIC-II write-up(http://www.zimmers.net/cbmpics/cbm/c64/vic-ii.txt) regarding RAM locations 0 and 1 within a 6510 context. Quote: With a similar effect you can also write to RAM addresses 0 and 1 from the processor. They are normally not available as the internal data direction register and data register of the 6510 I/O port are mapped to these addresses, and the data bus drivers stay in tri-state on a write access. But the R/W line is set to low state (this can be explained as the I/O port has been integrated afterwards into the existing design of the 6502) and so the byte read by the VIC in the first clock phase is written to RAM. If you want to write a certain value to addresses 0 or 1 you only have to write an arbitrary value to these addresses and take care that the VIC read the desired value from RAM in the clock phase before. So you would only see the address on the address bus for writing to memory location 0/1 and not the data to be written to this location. It is a rather interesting anomaly where RAM locations 0/1 would be populated with the data that the VIC read in the previous cycle if you wrote to locations 0/1. I wrote a assembly program to test this on the Vice emulator. I started off by populating the first screen line with A's and then wait till the raster line approaches these A's. With the raster line at this location I do a couple of writes to memory location 1. According to the theory memory location 0 should be populated with an image line of an 'A'. I then switch the location of screen memory to location 0. This will enable us to see memory locations 0 and 1 as the first 2 characters displayed on the screen. Here is the assembly: Code: 0000 SEI 78 0001 LDY #$07 A0 07 0003 LDA #$01 A9 01 0005 LDX #$27 A2 27 0007 LOOP STA $0400,X 9D 00 04 000A DEX CA 000B BPL LOOP 10 FA ; Populated the first screen line with 'A's 000D LOOP2 LDA $D011 AD 11 D0 0010 BMI LOOP2 30 FB 0012 LDA $D012 AD 12 D0 0015 CMP #$34 C9 34 0017 BNE LOOP2 D0 F4 ; Wait in a loop till we reached ratser line 52 0019 LDX #$03 A2 03 001B LOOP3 STY $0001 8C 01 00 001E DEX CA ; Write a value number of times to loc 1 001F BNE LOOP3 D0 FA ; Hopefully at last read we are in visible char region ; where VIC-II read a value at first phase 0021 LDA #$05 A9 05 0023 STA $D018 8D 18 D0 ; Move screen memory to location 0 ; first two chars on screen is locations 0 ; and 1 0026 LOOP4 BNE LOOP4 D0 FE At the bottom I have attached a screen shot how the screen looks like switching the location of screen memory to 0. You will see that the second character from the left at the top row is a less than symbol which have the screen code $3C. $3C is the second image line of the character A, which is what we expect since we did the writes at scan line 52. It would be interesting to know if you get the same result when running on a real C64. Attachment:
|
Author: | Dr Jefyll [ Sun Jan 21, 2018 5:31 pm ] |
Post subject: | Re: Snooping on the C64 Expansion port |
fastgear wrote: Quote: [...] the data bus drivers stay in tri-state on a write access. [...] [...] So you would only see the address on the address bus for writing to memory location 0/1 and not the data to be written to this location. [...] So, there are two ways they could've done it, equally acceptable (to them, at least ). While arranging to inhibit read data they apparently found it easiest to inhibit write data as well. Interesting trick about writing to RAM at locations 0 and 1, BTW! |
Author: | BigEd [ Sun Jan 21, 2018 7:00 pm ] |
Post subject: | Re: Snooping on the C64 Expansion port |
Interestingly enough, hoglet's intelligent 6502 protocol analyser would be able to tell what value the CPU is writing, even if it doesn't appear on the bus. |
Author: | fastgear [ Mon Jan 22, 2018 6:53 am ] |
Post subject: | Re: Snooping on the C64 Expansion port |
This is a very cool project! Looks like when doing this kind of bus snooping it is unavoidable to have some kind of 6502 emulator available to assist in dissecting the snooped info. This project have some interesting possibilities. I think with not too much effort, for instance, one should be able to replicate the screen output of your BBC Micro to a window on your computer screen! |
Page 1 of 1 | All times are UTC |
Powered by phpBB® Forum Software © phpBB Group http://www.phpbb.com/ |